# Rsync Manager — Security / Release Audit

This project targets direct macOS distribution using Developer ID signing and Apple notarisation. App Sandbox is intentionally disabled because the product launches `rsync`/SSH and operates on arbitrary user-configured filesystem paths.

## Security controls present

- Hardened Runtime enabled for Debug and Release target configurations.
- No shell (`/bin/sh -c`) command construction; `Process` uses an absolute executable path and argument array.
- SSH host-key checking is not disabled.
- Automated SSH uses BatchMode, timeout and keepalive limits.
- SSH password authentication/storage is not supported; legacy stored password data is deleted.
- Remote host, username, port, key path and remote destination are validated.
- Remote paths reject shell metacharacters before rsync can invoke the remote shell.
- Advanced arguments reject transport replacement, remote-command, credential, arbitrary list/log/batch path and destructive overrides.
- Malformed Advanced argument quoting/trailing escapes are rejected.
- `--` terminates rsync option parsing before source/destination operands.
- Local source/destination overlap is rejected.
- File-watch and exclusion values reject control characters.
- Scheduled/watch delete requires explicit per-job authorisation.
- Run logs are ANSI-cleaned, likely credentials redacted and size-capped before persistence.
- Run history has bounded retention.
- Privacy manifest declares no tracking/no collected data and the app-specific UserDefaults required reason.
- Launch at login uses `SMAppService` and remains user-controlled.
- No analytics/telemetry or application HTTP client code is present.

## Required release verification on a Mac

Run:

```bash
./Scripts/release-preflight.sh
```

Then archive with Developer ID, submit with Apple `notarytool` (or Xcode Organizer), staple the ticket and run the signature/Gatekeeper checks in `Docs/RELEASE.md`.

A Linux source audit cannot substitute for Xcode's macOS SDK typecheck, code signing, notarisation or Gatekeeper assessment.